How We Maintain 20 Client WordPress Sites with AI and RemoteWP
X-HOUSE, the web agency behind RemoteWP, maintains 20 client WordPress sites with AI agents connected through RemoteWP Pro, without FTP, SSH or database access to any client’s hosting. When a critical WordPress vulnerability was published in August 2026, 19 of the 20 sites were audited and updated on the same day.
This case study explains how the setup works, the rules that keep it safe, and what we learned. It contains no client names or client data: all figures are aggregated across the fleet.
The fleet at a glance
| Item | Figure |
|---|---|
| Client WordPress sites | 20 |
| Countries | Mostly Romania, plus Hungary and other EU markets |
| Types of sites | Business and service sites, online shops, event sites |
| Hosting providers | Several, chosen by the clients, with different security rules |
| FTP, SSH or database passwords used | None |
The challenge
Twenty sites means twenty different combinations of hosting, theme, page builder and plugins. Without a central connection, every update or fix means logging into a different hosting panel or WordPress dashboard, and keeping track of who has which password. Giving an AI assistant that kind of access is out of the question.
We wanted three things: one way to reach every site, no hosting credentials anywhere, and a written record of every change.
The setup
- RemoteWP Pro on every site. Each site exposes the RemoteWP API over HTTPS. That is the only way in.
- One connection record per site. It lists the API address, the authentication method and the permission level. Tokens are never written in the documentation: each record only names the variable where the token is stored.
- AI agents do the work. The agent reads the connection record, connects to the site and performs the task, following RemoteWP’s approval rules.
- A handoff after every intervention. The agent writes what it actually did, including failures, at the top of the site’s history.
The rules that keep it safe
AI makes maintenance faster, so the rules matter more, not less. These are the ones we follow on every client site:
- One site at a time. No operation runs across the whole fleet at once, so a mistake can never spread to twenty sites.
- Announce first. The agent states what it will do, and on which site, before doing it.
- Some actions always need an explicit request: major WordPress updates, deleting or deactivating plugins, changing admin accounts, switching themes and database operations.
- Verify after every change. The site must respond and run the expected version. A “200 OK” alone is not proof.
- Write it down. No intervention is finished until the handoff is written.
Result: a critical vulnerability, handled in a day
In August 2026 a critical WordPress security vulnerability was published. Using RemoteWP, the AI agent audited each site in turn, updated WordPress and plugins where needed, and verified the result.
- 19 of 20 sites were audited and brought up to date on the same day. The last one, on a separate managed care plan, followed ten days later.
- 17 sites were brought to the then-current WordPress release, 7.0.3.
- 2 sites stay on the patched WordPress 6.8 security branch.
- On the same 19 sites, plugins were checked and updated where needed in the same pass.
Every step is recorded in the site’s handoff, so the next person, or the next agent, knows exactly where each site stands.
What we learned
No two sites are configured the same
One site uses a different authentication header. Eight sites answer only on the www. address. Some hosts block direct PHP execution or allow access only from listed IP addresses. That is why the agent always reads the site’s connection record instead of guessing the address.
Small steps beat bulk operations
Updating one site, checking it and writing the handoff takes a few minutes longer than a mass update. In exchange, a failed update affects one site, and you know which one.
Clients want reports, not logs
RemoteWP keeps an activity history per site. We review it and send each client a short report in English or Romanian, chosen when the report is sent.
Run the same setup for your clients
Everything in this case study uses the standard RemoteWP Pro plugin. The Agency Elite plan covers unlimited sites, with a customer portal and per-domain client reports. See pricing, or start with How to Connect AI to WordPress.
Frequently asked questions
Does the AI have access to the client’s hosting?
No. The agent works remotely and enters the site only through the RemoteWP plugin. It never receives hosting, FTP, SSH or database passwords.
Can one mistake affect all sites?
Not with these rules. Work is done one site at a time, and every file change is backed up first.
How do clients know what was done?
Each intervention is recorded. We review the activity history and send the client a report in English or Romanian.
Which plan does an agency need?
Developer Pro covers up to 10 sites. For a fleet like ours, Agency Elite covers unlimited sites.